CVE-2025-36539: AVEVA PI Data Archive Uncaught Exception

Published Jun 12, 2025

Updated

AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary PI Data Archive subsystems, resulting in a denial of service.

Affected Software

6 affected components

: AVEVA PI Data Archive: Versions 2018 SP3 Patch 4 and prior (CVE-2025-44019)

: AVEVA PI Data Archive: Version 2023 (CVE-2025-44019, CVE-2025-36539)

: AVEVA PI Data Archive: Version 2023 Patch 1 (CVE-2025-44019, CVE-2025-36539)

: AVEVA PI Server: Versions 2018 SP3 Patch 6 and prior (CVE-2025-44019)

: AVEVA PI Server: Version 2023 (CVE-2025-44019, CVE-2025-36539)

: AVEVA PI Server: Version 2023 Patch 1 (CVE-2025-44019, CVE-2025-36539)

Remediation

Information

AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Users with affected product versions should apply security updates to mitigate the risk of exploit. All affected versions of PI Data Archive and PI Server can be fixed by upgrading to PI Server 2024 or higher. From OSISoft Customer Portal https://my.osisoft.com/ , search for "AVEVA PI Server" and select version 2024 or higher. For additional information please refer to AVEVA-2025-001 https://www.aveva.com/en/support-and-success/cyber-security-updates/ .

Event History

Jun 12, 2025

CVE Published

via MITRE·07:56 PM

Data Sourced

via MITRE·07:56 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-25-162-07

Frequently Asked Questions

What is the severity of CVE-2025-36539?

CVE-2025-36539 has a high severity rating since it allows authenticated users to trigger a denial of service by shutting down critical subsystems.

How do I fix CVE-2025-36539?

To fix CVE-2025-36539, you should upgrade to the latest version of AVEVA PI Data Archive or PI Server that is patched against this vulnerability.

Who is affected by CVE-2025-36539?

CVE-2025-36539 affects users of AVEVA PI Data Archive versions up to 2018 SP3 Patch 4 and all versions of AVEVA PI Server prior to the latest patches.

What is the impact of exploiting CVE-2025-36539?

Exploiting CVE-2025-36539 can result in a denial of service, impacting the availability of essential PI Data Archive subsystems.

Are there any workarounds for CVE-2025-36539?

Currently, no specific workarounds are recommended for CVE-2025-36539 besides applying the necessary updates as soon as possible.